PT-2024-31573 · Fortinet · Fortisoar

Published 2024-09-11 · Updated 2025-01-21 · CVE-2024-45327

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiSOAR versions 7.0.0 through 7.0.3 FortiSOAR versions 7.2.0 through 7.2.2 FortiSOAR versions 7.3.0 through 7.3.2 FortiSOAR versions 7.4.0 through 7.4.3

Description An improper authorization issue in the change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators' passwords via crafted HTTP requests. This could lead to unauthorized access.

Recommendations For FortiSOAR versions 7.0.0 through 7.0.3, patch immediately and enforce strong password policies. For FortiSOAR versions 7.2.0 through 7.2.2, patch immediately and enforce strong password policies. For FortiSOAR versions 7.3.0 through 7.3.2, patch immediately and enforce strong password policies. For FortiSOAR versions 7.4.0 through 7.4.3, patch immediately and enforce strong password policies. As a temporary workaround, consider restricting access to the change password endpoint until a patch is available.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-45327

Affected Products

Fortisoar

References · 10

• https://fortiguard.fortinet.com/psirt/FG-IR-24-048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45327 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45327 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1833845061265613299 · Twitter Post
• https://t.me/cvenotify/108154 · Telegram Post
• https://t.me/cvedetector/5343 · Telegram Post
• https://twitter.com/CCBalert/status/1834269658960072998 · Twitter Post
• https://twitter.com/CVEnew/status/1833827705789514075 · Twitter Post
• https://twitter.com/oktsec/status/1833841479736803510 · Twitter Post
• https://t.me/cvenotify/94134 · Telegram Post